Meta tags:
description=Shows you how to deploy an Active Directory forest on Compute Engine in a way that follows the best practices.;

Headings (most frequently used words):

deploy, create, and, the, active, directory, forest, on, network, project, vpc, domain, an, compute, engine, stay, organized, with, collections, save, categorize, content, based, your, preferences, architecture, before, you, begin, shared, what, next, delete, default, custom, mode, subnets, firewall, rules, prepare, configuration, private, dns, forwarding, zone, dsrm, password, controllers, connect, to, controller, products, pricing, support, resources, engage,

Text of the page (most frequently used words):
the (172), and (160), cloud (104), for (96), project (59), google (57), you (57), #compute (52), domain (50), #create (49), architecture (46), network (45), overview (44), with (42), deploy (42), data (40), directory (39), active (38), that (34), gcloud (33), roles (32), vpc (30), from (27), using (26), region (26), use (24), subnet (24), hybrid (23), enable (23), engine (23), this (22), forest (22), controllers (22), service (22), dns (22), get (22), security (22), tcp (21), access (21), your (21), rules (19), practices (19), patterns (18), best (18), migrate (18), allow (17), content (16), firewall (16), multicloud (16), page (15), metadata (15), private (15), platform (15), new (15), shared (15), workloads (15), design (15), password (14), zone (14), secure (14), name (14), vpcname (14), udp (14), networking (14), reference (14), resources (13), user (13), controller (13), windows (13), management (13), ingress (13), applications (13), all (12), configure (12), secret (12), account (12), host (12), deployment (12), infrastructure (12), application (12), single (12), view (12), manage (11), agent (11), following (11), projects (11), two (11), role (11), migration (11), optimize (11), oracle (10), through (10), can (10), one (10), zones (10), accounts (10), set (10), value (10), admin (10), logging (10), pattern (10), storage (10), analytics (10), gke (10), reliability (10), build (10), cross (10), about (9), system (9), need (9), more (9), identity (9), forwarding (9), now (9), domaincontroller (9), monitoring (9), activedirectorydnsdomain (9), projectid (9), dsrmpassword (9), iam (9), permission (9), managed (9), networks (9), apis (9), select (9), plan (9), resource (9), guide (9), enterprise (9), sign (8), see (8), other (8), what (8), next (8), addresses (8), administrator (8), startup (8), run (8), manager (8), grant (8), example (8), subnets (8), implement (8), amazon (8), action (7), thumb (7), are (7), vms (7), powershell (7), instances (7), tags (7), script (7), address (7), shielded (7), vpcprojectid (7), regions (7), default (7), generate (7), required (7), custom (7), contains (7), ranges (7), logs (7), range (7), development (7), architectures (7), sql (7), mesh (7), rag (7), center (6), information (6), learn (6), environment (6), then (6), monitor (6), ps1 (6), protection (6), created (6), activedirectorynetbiosdomain (6), property (6), write (6), mode (6), replace (6), usage (6), how (6), direction (6), source (6), priority (6), connectivity (6), premises (6), distributed (6), compliance (6), assess (6), database (6), multi (6), optimization (6), code (5), started (5), instance (5), have (5), log (5), settings (5), process (5), file (5), previously (5), install (5), services (5), dsrm (5), server (5), addnsdomain (5), format (5), config (5), console (5), subnetrangeresources (5), 10000 (5), delete (5), cidr (5), microsoft (5), pipelines (5), pci (5), apps (5), provisioning (5), business (5), product (5), regional (5), gated (5), cost (5), generative (5), agentic (5), performance (5), português (4), español (4), join (4), products (4), down (4), across (4), automatically (4), connect (4), secrets (4), serial (4), port (4), output (4), image (4), machine (4), dcserviceaccount (4), disable (4), activedirectoryfirstdc (4), promote (4), read (4), instance_only (4), tempfile (4), any (4), vpc_name (4), shell (4), prepare (4), permissions (4), iap (4), owner (4), serviceusage (4), selector (4), which (4), resourcemanager (4), 65535 (4), target (4), 389 (4), 445 (4), replication (4), large (4), tools (4), costs (4), solutions (4), automate (4), blueprint (4), continuous (4), entra (4), availability (4), recovery (4), operations (4), model (4), learning (4), decide (4), operational (4), continuously (4), privacy (3), samples (3), support (3), last (3), 2024 (3), utc (3), otherwise (3), its (3), doesn (3), rdp (3), connecting (3), restarting (3), apply (3), 2022 (3), standard (3), addressofdc2 (3), let (3), sysprep (3), configuring (3), subnetworks (3), adnetbiosdomain (3), true (3), addressofdc1 (3), lsa (3), each (3), already (3), configuration (3), import (3), attributes (3), secretmanager (3), com (3), false (3), out (3), automation (3), tostring (3), define (3), queries (3), core (3), 123 (3), west1 (3), based (3), root (3), cli (3), activate (3), open (3), might (3), organizations (3), secured (3), section (3), rule (3), ldap (3), addc (3), subnetrangedomaincontrollers (3), servers (3), traffic (3), devops (3), documentation (3), observability (3), industry (3), databases (3), hosting (3), systems (3), strategy (3), environments (3), scale (3), workspace (3), load (3), global (3), consumer (3), onboarding (3), high (3), postgresql (3), spanner (3), cases (3), approaches (3), kubernetes (3), rds (3), considerations (3), exadata (3), bigquery (3), device (3), controls (3), multimodal (3), excellence (3), improve (3), 한국어 (2), 日本語 (2), עברית (2), brasil (2), italiano (2), indonesia (2), français (2), américa (2), latina (2), deutsch (2), english (2), third (2), terms (2), site (2), youtube (2), pricing (2), understand (2), updated (2), licensed (2), under (2), apache (2), license (2), send (2), feedback (2), aware (2), versions (2), latest (2), wait (2), minutes (2), until (2), message (2), press (2), ctrl (2), tail (2), initialization (2), second (2), viewing (2), first (2), family (2), type (2), interface (2), scopes (2), integrity (2), boot (2), vtpm (2), deletion (2), features (2), specialize (2), guest (2), command (2), does (2), windowsfeature (2), uses (2), only (2), env (2), hostname (2), accesstoken (2), authorization (2), encoding (2), domainname (2), safemodeadministratorpassword (2), win2008r2 (2), installdns (2), norebootoncompletion (2), confirm (2), start (2), null (2), netadapter (2), interfaceindex (2), minimize (2), manual (2), expiry (2), add (2), time (2), random (2), guid (2), newguid (2), remove (2), store (2), they (2), targets (2), reserve (2), static (2), associated (2), attach (2), names (2), additional (2), vpchost_project_id (2), netbios (2), netbios_domain (2), dns_domain (2), variables (2), dc_project_id (2), pwsh (2), launch (2), also (2), able (2), predefined (2), granting (2), folders (2), ask (2), likely (2), serviceusageadmin (2), verify (2), billing (2), enabled (2), creator (2), projectcreator (2), selecting (2), require (2), specific (2), been (2), granted (2), deny (2), problems (2), connections (2), icmp (2), 135 (2), 464 (2), 3268 (2), 49152 (2), between (2), internet (2), resources_cidr (2), dc_cidr (2), list (2), quiet (2), project_id (2), make (2), sure (2), describes (2), requirements (2), existing (2), running (2), home (2), sdk (2), languages (2), frameworks (2), lustre (2), fuse (2), virtual (2), palo (2), alto (2), series (2), ngfw (2), graph (2), mitigation (2), attacks (2), identification (2), datasets (2), gemini (2), dss (2), scope (2), functions (2), gmail (2), federation (2), federate (2), planning (2), concepts (2), continuity (2), backup (2), striim (2), architecting (2), locality (2), restricted (2), scenarios (2), building (2), blocks (2), disaster (2), vmware (2), providers (2), stream (2), export (2), live (2), delivery (2), architectural (2), principles (2), resilient (2), aws (2), aurora (2), alloydb (2), mysql (2), deployments (2), discover (2), render (2), farm (2), peering (2), inter (2), egress (2), edge (2), suite (2), end (2), iot (2), develop (2), pipeline (2), gateway (2), methodology (2), developer (2), vision (2), mlops (2), guidelines (2), personalized (2), inference (2), serving (2), graphrag (2), orchestrate (2), workflows (2), choose (2), landing (2), pillars (2), align (2), culture (2), sustainability (2), take (2), advantage (2), perform (2), testing (2), failures (2), technology (2), areas (2), close (2), subscribe, newsletter, our, decade, climate, cookies, tech, twitter, events, blog, engage, training, certification, getting, github, status, release, notes, community, forums, contact, sales, marketplace, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, sample, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, except, noted, details, java, registered, trademark, affiliates, developers, policies, creative, commons, attribution, firewalls, because, public, must, proxy, customize, ready, another, place, different, during, phase, enabling, disabling, assign, ipv6, loopback, erroractionpreference, stop, not, ciminstance, classname, win32_operatingsystem, producttype, exit, module, programfiles, gce_base, psm1, project_only, token, convertfrom, json, access_token, invoke, restmethod, headers, flavor, goog, bearer, uri, https, googleapis, text, utf8, getstring, convert, frombase64string, payload, convertto, securestring, asplaintext, force, setting, localuser, computername, creating, addsforest, domainnetbiosname, domainmode, forestmode, creatednsdelegation, else, waiting, become, available, sleep, ipconfig, flushdns, nltest, dsgetdc, while, lastexitcode, adding, addsdomaincontroller, credential, object, pscredential, netadapterbinding, componentid, ms_tcpip6, dnsclientserveraddress, ethernet, serveraddresses, 127, itemproperty, path, hklm, currentcontrolset, control, runasppl, propertytype, dword, restart, computer, ascii, number, steps, scripts, datetime, utcnow, addhours, policy, binding, member, serviceaccount, secretaccessor, condition, title, expires, after, expression, request, timestamp, hour, display, email, temporaryfile, nonewline, item, temporary, restore, description, visibility, forward, reserved, internal, forwards, these, notice, specify, extend, cover, closed, session, step, tunnelresourceaccessor, tunnel, serviceaccountuser, serviceaccountadmin, instanceadmin, 65000, optional, failed, attempts, useful, diagnosing, but, produce, significant, volume, ldaps, 636, logon, 9389, logons, order, work, clouddns, 199, 192, 3389, 235, 240, communication, within, without, used, central1, initialize, filter, creates, configured, means, pre, allocated, assigned, auto, xpnadmin, securityadmin, networkadmin, parent, folder, later, choosing, naming, conventions, don, overlap, sufficient, room, growth, administrative, workstations, enough, accommodate, recommend, sized, dedicated, helps, distinguish, when, analyzing, follow, instructions, before, begin, yourself, consider, fully, unless, some, cannot, accommodated, note, integrate, separate, them, lets, deployed, consists, intended, administrators, engineers, assumes, solid, understanding, basic, knowledge, document, way, follows, described, reviewed, save, categorize, preferences, stay, organized, collections, parallel, hpc, optimal, workload, identify, prioritize, risks, wiz, owasp, top, 2021, options, mitigate, ransomware, protecting, against, cryptocurrency, mining, mitigating, compromised, oauth, tokens, malware, scanning, files, uploaded, avoidance, pii, dlp, saas, spinone, guidance, government, tokenize, sensitive, cardholder, limit, serverless, armor, balancing, cdn, programmable, front, ends, context, securing, apigee, announcement, reconcile, orphaned, sanitize, evict, unwanted, consolidate, okta, keycloak, portal, integration, b2b, impact, consolidation, plans, federating, external, provider, clusters, afi, floating, outages, reliable, centralized, appliances, fortigate, hub, spoke, datadog, bindplane, splunk, metric, metrics, riot, redis, facing, intra, migrating, terminology, batch, architect, containers, azure, lambda, eks, ec2, validating, automated, containerized, transfer, foundation, cohesity, helios, party, integrations, implementation, authenticate, workforce, users, nvas, affinity, general, handover, meshed, mirrored, bursting, partitioned, tiered, adopt, drivers, peoplesoft, consume, self, into, warehouse, big, website, bare, metal, backend, pub, sub, connection, standalone, mqtt, broker, connected, linux, chrome, remote, desktop, guacamole, research, assessment, dora, capabilities, deliver, decision, records, lifecycle, container, runtime, servicenow, governance, globally, expose, optimized, mapping, beyondprod, cymbal, bank, attributions, scalable, styles, labeling, labelbox, tower, retrieval, candidate, generation, silo, federated, confidential, computing, solution, dataflow, api, tensorflow, extended, quality, predictive, implementing, customer, questions, podcasts, audio, recommendations, marketing, campaigns, utilization, review, health, insurance, claims, backends, operate, harness, vector, search, capable, disparate, orchestration, bidirectional, streaming, classify, trusted, maps, lakehouse, science, administer, interactive, adk, tenant, components, preventative, detective, organization, structure, authentication, foundations, hierarchy, comparative, analysis, zonal, archetypes, financial, pillar, perspectives, measure, energy, efficient, software, low, carbon, modular, elasticity, allocation, foster, awareness, spending, conduct, thorough, postmortems, loss, graceful, degradation, detect, potential, horizontal, scalability, redundancy, realistic, experience, goals, responsibility, fate, meet, regulatory, needs, securely, responsibly, preemptive, cyber, defense, shift, left, zero, trust, innovate, change, incidents, ensure, readiness, cloudops, well, architected, framework, fundamentals, free, skip, main,

Text of the page (random words):
project select a project selecting a project doesn t require a specific iam role you can select any project that you ve been granted a role on create a project to create a project you need the project creator role roles resourcemanager projectcreator which contains the resourcemanager projects create permission learn how to grant roles go to project selector verify that billing is enabled for your google cloud project enable the compute engine and cloud dns apis roles required to enable apis to enable apis you need the serviceusage services enable permission if you created the project then you likely already have this permission through the owner role roles owner otherwise you can get this permission through the service usage admin role roles serviceusage serviceusageadmin learn how to grant roles enable the apis to get the permissions that you need to deploy a shared network ask your administrator to grant you the following iam roles on the project or parent folder compute network admin roles compute networkadmin compute security admin roles compute securityadmin compute shared vpc admin roles compute xpnadmin dns administrator roles dns admin for more information about granting roles see manage access to projects folders and organizations you might also be able to get the required permissions through custom roles or other predefined roles delete the default vpc by default compute engine creates a default network in each new project that you create this network is configured in auto mode which means a subnet is pre allocated for each region and is automatically assigned a cidr range in this section you replace this vpc network with a custom mode network that contains two subnets and that uses custom cidr ranges in the google cloud console open cloud shell activate cloud shell launch powershell pwsh configure the gcloud cli to use the new project gcloud config set project project_id replace project_id with the id of your project delete all firewall rules that are associated with the default vpc projectid gcloud config get value core project gcloud compute firewall rules list filter network default format value name gcloud compute firewall rules delete quiet _ project projectid delete the default vpc gcloud compute networks list format value name gcloud compute networks delete _ quiet create a custom mode vpc network you now create a custom mode vpc network in the your vpc host project in powershell initialize the following variables vpcname vpc_name region region subnetrangedomaincontrollers dc_cidr subnetrangeresources resources_cidr replace the following vpc_name the name of the vpc region the region to deploy the active directory domain controllers in dc_cidr the subnet range to use for the domain controllers subnet resources_cidr the subnet range to use for the resource subnet example vpcname ad region us central1 subnetrangedomaincontrollers 10 0 0 0 28 subnetrangeresources 10 0 1 0 24 create the vpc and configure it to be used as a shared vpc network projectid gcloud config get value core project gcloud compute networks create vpcname subnet mode custom gcloud compute shared vpc enable projectid create the subnets and enable private google access so that windows can activate without internet access gcloud compute networks subnets create domain controllers network vpcname range subnetrangedomaincontrollers region region enable private ip google access gcloud compute networks subnets create resources network vpcname range subnetrangeresources region region enable private ip google access deploy subnets and firewall rules you now create firewall rules to allow active directory communication within the vpc allow rdp connections to all vm instances through cloud iap tcp forwarding gcloud compute firewall rules create allow rdp ingress from iap direction ingress action allow rules tcp 3389 enable logging source ranges 35 235 240 0 20 network vpcname priority 10000 allow dns queries from cloud dns to domain controllers gcloud compute firewall rules create allow dns ingress from clouddns direction ingress action allow rules udp 53 tcp 53 enable logging source ranges 35 199 192 0 19 target tags ad domaincontroller network vpcname priority 10000 this firewall rule is required in order for the private dns forwarding zone to work allow active directory replication between domain controllers gcloud compute firewall rules create allow replication between addc direction ingress action allow rules icmp tcp 53 udp 53 tcp 88 udp 88 udp 123 tcp 135 tcp 389 udp 389 tcp 445 udp 445 tcp 49152 65535 enable logging source tags ad domaincontroller target tags ad domaincontroller network vpcname priority 10000 allow active directory logons from vms that are in the resources subnet to domain controllers gcloud compute firewall rules create allow logon ingress to addc direction ingress action allow rules icmp tcp 53 udp 53 tcp 88 udp 88 udp 123 tcp 135 tcp 389 udp 389 tcp 445 udp 445 tcp 464 udp 464 tcp 3268 udp 3268 tcp 9389 tcp 49152 65535 enable logging source ranges subnetrangeresources target tags ad domaincontroller network vpcname priority 10000 if you plan to configure secure ldap allow secure ldap connections from vms that are in the resources subnet to domain controllers gcloud compute firewall rules create allow ldaps ingress to addc direction ingress action allow rules tcp 636 enable logging source ranges subnetrangeresources target tags ad domaincontroller network vpcname priority 10000 you only need this firewall rule if you plan to configure secure ldap optional create a firewall rule that logs all failed access attempts the logs can be useful for diagnosing connectivity problems but they might produce a significant volume of log data gcloud compute firewall rules create deny ingress from all direction ingress action deny rules tcp 0 65535 udp 0 65535 enable logging source ranges 0 0 0 0 0 network vpcname priority 65000 deploy the active directory forest in this section you create a new service project and attach it to the shared vpc host project that you created previously you then use the service project to deploy a new active directory forest with two domain controllers create a project you now create a new project and use it to deploy the active directory domain controller vms in the google cloud console on the project selector page select or create a google cloud project roles required to select or create a project select a project selecting a project doesn t require a specific iam role you can select any project that you ve been granted a role on create a project to create a project you need the project creator role roles resourcemanager projectcreator which contains the resourcemanager projects create permission learn how to grant roles go to project selector verify that billing is enabled for your google cloud project enable the compute engine and secret manager apis roles required to enable apis to enable apis you need the serviceusage services enable permission if you created the project then you likely already have this permission through the owner role roles owner otherwise you can get this permission through the service usage admin role roles serviceusage serviceusageadmin learn how to grant roles enable the apis to get the permissions that you need to deploy the active directory forest ask your administrator to grant you the following iam roles on the project compute instance admin v1 roles compute instanceadmin v1 service account admin roles iam serviceaccountadmin service account user roles iam serviceaccountuser secret manager admin roles secretmanager admin iap secured tunnel user roles iap tunnelresourceaccessor for more information about granting roles see manage access to projects folders and organizations you might also be able to get the required permissions through custom roles or other predefined roles prepare the configuration the next step is to prepare the configuration for the active directory deployment if you previously closed the powershell session open cloud shell activate cloud shell launch powershell pwsh configure the gcloud cli to use the new project gcloud config set project dc_project_id replace dc_project_id with the id of your project use powershell to create the following variables addnsdomain dns_domain adnetbiosdomain netbios_domain vpcprojectid vpchost_project_id vpcname vpc_name region region zones region a region b replace the following dns_domain the forest root domain name of the active directory forest for example cloud example com netbios_domain the netbios domain name for the forest root domain for example cloud vpchost_project_id the project id of the vpc host project that you created previously vpc_name name of the shared vpc network that you created previously region region to deploy the active directory domain controllers in notice that the names of the zones are based on the names of the region that you specify you can extend the vpc and your domain to cover additional regions at any time example addnsdomain cloud example com adnetbiosdomain cloud vpcprojectid vpc project 123 vpcname ad region us west1 zones us west1 a us west1 b create a private dns forwarding zone you now reserve two static ip addresses for your domain controllers and create a private dns forwarding zone that forwards all dns queries for the active directory domain to these ip addresses attach the project to the shared vpc network projectid gcloud config get value core project gcloud compute shared vpc associated projects add projectid host project vpcprojectid reserve two static internal ip addresses in the domain controllers subnet addressofdc1 gcloud compute addresses create dc 1 region region subnet projects vpcprojectid regions region subnetworks domain controllers format value address addressofdc2 gcloud compute addresses create dc 2 region region subnet projects vpcprojectid regions region subnetworks domain controllers format value address create a cloud dns private forwarding zone in the vpc host project and configure the zone to forward dns queries to the two reserved ip addresses gcloud dns managed zones create addnsdomain replace project vpcprojectid dns name addnsdomain description active directory forwarding zone networks vpcname visibility private forwarding targets addressofdc1 addressofdc2 create a dsrm password you now define the directory service restore mode dsrm password and store it in secret manager you then grant the domain controller vms temporary access to this secret so that they can use it to deploy the active directory forest generate a random password and store it in a secret manager secret generate a random password dsrmpassword guid newguid tostring guid newguid tostring tempfile new temporaryfile set content tempfile dsrmpassword nonewline gcloud secrets create ad password data file tempfile remove item tempfile create the service account for the domain controller vm instances dcserviceaccount gcloud iam service accounts create ad domaincontroller display name ad domain controller format value email grant the service account permission to read the secret for the next hour expiry datetime utcnow addhours 1 tostring o gcloud secrets add iam policy binding ad password member serviceaccount dcserviceaccount role roles secretmanager secretaccessor condition title expires after 1h expression request time timestamp expiry deploy domain controllers you now deploy two vm instances and create a new active directory forest and domain to minimize the number of manual steps you use startup scripts in powershell run the following command to generate a startup script erroractionpreference stop only run the script if the vm is not a domain controller already if get ciminstance classname win32_operatingsystem producttype eq 2 exit read configuration from metadata import module env programfiles google compute engine sysprep gce_base psm1 activedirectorydnsdomain get metadata property attributes activedirectorydnsdomain instance_only activedirectorynetbiosdomain get metadata property attributes activedirectorynetbiosdomain instance_only activedirectoryfirstdc get metadata property attributes activedirectoryfirstdc instance_only projectid get metadata property project id project_only hostname get metadata property hostname instance_only accesstoken get metadata property service accounts default token convertfrom json access_token read the dsrm password from secret manager secret invoke restmethod headers metadata flavor google x goog user project projectid authorization bearer accesstoken uri https secretmanager googleapis com v1 projects projectid secrets ad password versions latest access dsrmpassword system text encoding utf8 getstring system convert frombase64string secret payload data dsrmpassword convertto securestring asplaintext dsrmpassword force promote write host setting administrator password set localuser name administrator password dsrmpassword if activedirectoryfirstdc eq env computername write host creating a new forest activedirectorydnsdomain activedirectorynetbiosdomain install addsforest domainname activedirectorydnsdomain domainnetbiosname activedirectorynetbiosdomain safemodeadministratorpassword dsrmpassword domainmode win2008r2 forestmode win2008r2 installdns creatednsdelegation false norebootoncompletion true confirm false else do write host waiting for domain to become available start sleep s 60 ipconfig flushdns out null nltest dsgetdc activedirectorydnsdomain out null while lastexitcode ne 0 write host adding dc to activedirectorydnsdomain activedirectorynetbiosdomain install addsdomaincontroller domainname activedirectorydnsdomain safemodeadministratorpassword dsrmpassword installdns credential new object system management automation pscredential administrator activedirectorydnsdomain dsrmpassword norebootoncompletion true confirm false configure dns write host configuring dns settings get netadapter disable netadapterbinding componentid ms_tcpip6 set dnsclientserveraddress interfaceindex get netadapter name ethernet interfaceindex serveraddresses 127 0 0 1 enable lsa protection new itemproperty path hklm system currentcontrolset control lsa name runasppl value 1 propertytype dword write host restarting to apply all settings restart computer out file dc startup ps1 encoding ascii the script does the following read the dsrm password from secret manager promote the vm to a domain controller configure dns settings so that each domain controller uses the loopback address as a dns server disable ipv6 enable lsa protection create a vm instance for the first domain controller subnet projects vpcprojectid regions region subnetworks domain controllers metadata activedirectorydnsdomain addnsdomain activedirectorynetbiosdomain adnetbiosdomain activedirectoryfirstdc dc 1 sysprep specialize script ps1 install windowsfeature ad domain services install windowsfeature dns disable account manager true join gcloud compute instances create dc 1 image family windows 2022 ...